When scanners miss the attack: how Cloudflare Client-Side Security protects storefronts

Public security scanners missed 100% of the active attack campaigns, but Cloudflare's client-side ML caught all eight live payloads—including a malicious script that sat unclassified on URLScan for two and a half years. 👇

E-commerce storefronts can look completely normal while rogue JavaScript quietly runs in the shopper's browser. These scripts steal affiliate commissions, suppress analytics, and open live remote backdoors. Traditional scanners miss them because the code uses strict cloaking rules—waking up only for targeted mobile devices, specific campaign links, or narrow time windows, while staying dormant for security crawlers.

Cloudflare built Page Shield ML to analyze hostile JavaScript at runtime. Instead of relying on static file hashes or known bad URLs, the system judges what the code actually tries to do inside live browser sessions.

The detection flow moves through a multi-stage pipeline: Graph Neural Network → Workers AI LLM → Frontier Model Cohort.

It starts with a Graph Neural Network (GNN). Rather than scanning flat text, the GNN turns JavaScript into a syntax tree that links symbols, function calls, and network requests. This lets it spot hostile patterns even across minification, variable renaming, and obfuscation.

Because the GNN flags less than 0.3% of analyzed traffic, Cloudflare routes those edge cases to a lightweight LLM on Workers AI for a fast second opinion.

For the trickiest scripts, an ensemble of frontier AI models steps in as automated agents. Each model runs in an independent session with access to a restricted JavaScript evaluator to unpack concealed snippets. If the models disagree on the script's intent, their votes are weighted to create a probability distribution across four labels: benign, payment skimming, cryptomining, or malware. Humans only review scripts that lack a clear two-thirds majority.

This continuous inspection caught four sophisticated operations in the wild. One payload hid behind a maze of conditions: it verified the viewport was under 477 pixels, checked for specific ad campaign tags, filtered out an explicit list of 325 IP addresses, and then deleted nine third-party analytics scripts from the page to blind the store's monitoring. Another used a `MutationObserver` to intercept taps on late-loading product tiles, launching a dual-tab detour that silently stole attribution cookies.

Cloudflare surfaced all eight live payloads across the four campaigns without relying on static signatures. Seven of those payloads were completely absent from VirusTotal, and URLScan failed to flag a single one as malicious.